Security Operations Centers field a constant stream of alerts from endpoints, cloud workloads, network devices, identity providers and business applications. SIEM and XDR platforms offer visibility, but analysts still burn time correlating alerts, digging through documentation and working out the next investigative step. Wazuh is positioning AI as an assistant rather than a replacement for that human expertise, adding contextual explanations, findings summaries and remediation suggestions.

The centerpiece for cloud customers is the Wazuh AI Analyst, an automated service for Wazuh Cloud subscriptions that runs security data through Amazon Bedrock and Anthropic's Claude with no manual configuration. It periodically emails key indicators, a histogram of protected endpoints, alert volume, active vulnerabilities and a posture summary, with a full PDF report attached. Reports follow the subscription's schedule and are also viewable in the cloud console under Environments > AI Reports. Wazuh says subscription data is not shared with third parties or used to train models, and is processed only to generate reports, with encrypted transmission, isolated processing and no permanent storage. Recommendations remain advisory and should be checked against organizational policy.

Self-deployed users have options too. One integration runs Meta's open-source Llama locally via Ollama on the Wazuh server, with a Python script decompressing archived logs for a chosen period, vectorizing them into a FAISS store and serving a LangChain-powered chatbot, keeping everything on the local network for strict privacy or data-residency needs. Another surfaces Anthropic's Claude 3.5 Haiku, hosted on Amazon Bedrock, as a chat box in the dashboard through the OpenSearch Assistant, set up by enabling the model in Bedrock, installing OpenSearch plugins and creating an ML Commons connector, model and conversational agent.

Source: The Hackers News